Today, organizations are outsourcing more and more of their IT applications, systems, and infrastructure, and moving to the cloud. But can their IT leaders depend solely on the vendors’ promises and contract agreements about delivering these services securely? It’s one thing to articulate security concerns but another to live with risks, including job loss, which could arise while someone external has control of these services. How can IT leaders secure these extensions to their IT departments? What has been tried? What has worked or not worked?